International Journal of Applied Research and Studies (iJARS) 
ISSN: 2278-9480 Volume 3, Issue 12 (December - 2014) 
www.ijars.in 



Research Article 

An Efficient Dual Port TCAM-Based Implementation of Adaptive 
Instruction and Memory Efficient Pattern Identifying System 



Authors: 

^aldari Chakra Rao*, 2 K Rajasekhar 

Address For correspondence: 

1 2 

' Department of Electronics and Communication Engineering ASR College of Engineering, Tanuku Andhra 

Pradesh, India 



Abstract: In this thesis, am presenting a multi-pattern 
matching algorithm with low area and less complexity. Before 
going to store patterns in database; patterns decoding is done 
with an efficient approach like TCAM. Both Ternary and 
binary combines to form TCAM patterns. This project is 
developed with an adaptively dividable dual-port Bi-TCAM to 
achieve a high-throughput, low-power and low-cost pattern- 
detection processor for multipurpose devices. 
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I. INTRODUCTION 

Intrusion detection systems (IDSs) are designed to time and 
it constructs a finite state machine to do so. Detect various 
hazardous contents and alert there existence finding 
occurrences in a text string T, of any pattern in the networks. 
CONTENT ADDRESSABLE memory (CAM) can be used to 
simultaneously compare the input datum with all the data 
stored in the memory, Due to the parallel operations, the CAM 
is useful for applications that demand high data-search speed, 
such as data base access, image processing and IP address 
lookup. Network security systems require a great amount of 
pattern matching operations to compare the input network 
packet with the pre-defined rule set for protecting the system 
from network attacks such as worms and patterns. Recently 
several papers proposed hardware-based pattern matching 
approaches for white line network security systems. However, 
these designs are not suitable for mobile B devices mainly 
because of two drawbacks. First, due to their hardware 
limitation, they are aimed at data matching with only a few 
thousand of networks patterns in SNORT (an open source 
network intrusion prevention system). They are also not 
scalable to perform any anti-pattern scanning, since the number 
of pattern-patterns is one order larger than SNORT 



II. PATTERN DETECTION 

The design considerations fro a pattern-detection engine in 
mobile devices are analyzed as follow 

1. The system throughput should reach uoto 1GBPS for 
supporting real-time pattern detection. 

2. The scalability of handling more than ten thousands patterns 
is required for versatile network protection. In addition, the 
system must be highly flexible to accommodate the rapidly 
increasing new pattern-patterns. 

3. Power consumption is the most important design 
consideration for mobile devices. 

The increasing pattern will greatly increase the power 
consumption and the cost of on-chip CAMs. The memory 
design is critical for dealing with increasingly large pattern 
database. 

III. PREPARE YOUR PAPER BEFORE STYLING 

A signature is a characteristic byte-pattern that is part of a 
certain pattern or family of patterns, if a pattern scanner finds 
such a pattern in a file, it notifies the user that the file is 
infected. The user then can delete, or (in some cases) "clean 
"&"heal" the infected file. Some patterns employ techniques 
that make detection by means of signatures difficult but 
probably not impossible. These patterns modify their code on 
each infection. This is, each infected file contains a different 
variant of the pattern. Most modern anti-pattern programs try to 
find pattern-patterns inside ordinary programs by scanning 
them for so called pattern signatures. 
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IV. CAM (CONTENT ADDRESSABLE MEMORY) 

CAMs (content addressable memory) are hardware search 
engines that are much faster than algorithmic approaches for 
search-intensive applications. CAMs are composed of 
conventional semiconductor memory (usually SRAM) with 
added comparison circuitry that enables a search operation to 
complete in a single clock cycle. The two most common 
search-intensive tasks that use CAMs are packet forwarding 
and packet classification in internet routers. We survey recent 
developments in the design of large-capacity content 
addressable memory (CAM). A CAM is a memory that 
implements the lookup table function in a single clock cycle 
using dedicated comparison circuitry. CAMs are especially 
popular in network routers for packet forwarding and packet 
classification, but they are also beneficial in a variety of 
applications that require high-speed lookup table. 

V. BINARY AND TERNARY CAM 

Binary CAM is the simplest type of CAM which uses data 
search words comprised entirely of Is and 0s. Ternary CAM 
allows a there matching state of "X" or "Don't Care" for one or 
more bits in the stored data word, thus adding flexibility to the 
search. For example a ternary CAM might have stored word of 
"10XX0" which will match any of the four search words 
"10000","10010","10100"or"10110".The added search 
flexibility comes at an additional cost over binary CAM as the 
internal memory cell must now encode three possible states 
instead of the two of binary CAM. This additional state is 
typically implemented by adding a mask bit ("care" or "don't 
care" bit) to every memory cell. The combination of both 
binary and ternary is known as Bit-CAM. 

VI. ARCHITECTURE 

The design considerations for a virus-detection engine in 
mobile devices are analyzed as follows. 

1) The system throughput should reach up to 1GBPS for 
supporting real-time virus detection in mobile devices adopting 
4G wireless systems. 

2) The scalability of handling more than ten thousands 
patterns is required for versatile network protection. In 
addition, the system must be highly flexible to accommodate 
the rapidly increasing new virus patterns. 

3) Power consumption is the most important design 
consideration for mobile devices. The increasing virus pattern 
will greatly increase the power consumption and the cost of on- 
chip CAMs. The memory design is critical for dealing with the 
increasingly large virus database. 

The key idea of our proposed virus -detection processor is to 
condense as much information on-chip as possible such that 
most of the input data can be quickly scanned with further 
inspection. The entire virus scanning is split into two phases: 
fast on-chip filtering by the filtering engine and the exactly 
matching with some off -chip memory accesses. Only important 
filtering signatures and skip data are stored on the chip. In 



order to reduce the on-chip memory, the filtering engine 
operates only on the fixed amount of the memory, including a 
16-kb TCAM and an 8.5 -kb SRAM. These filtering data are 
extracted from the entire virus database by pre-processing the 
30k virus patterns released from the Clam AV. The 
preprocessing tool also generates a suffix pattern tree, which 
will be stored in the off-chip memory. Because most of the 
input data is safe, experimental results show that more than 
80% of the data can be quickly processed by the filtering 
engine. 

VII. OPERATION PRINCIPLE 

The filtering engine screens impossible matches by 
consulting two TCAM lookup tables (named no-plane and yes- 
plane), which are used to perform two steps of the on-chip 
data-scanning. We modified the Wu-Manber algorithm to 
obtain a fast shift table, Which indicates the impossible 
matching pattern (so-called no-plane). By comparing the input 
datum with the no-plane TCAM from the least significant bit 
(LSB), the engine first looks up the shift table to perform a 
quick shift of impossible bytes until locating a possible match. 
If the input datum is matched with an entry of no-plane, the 
input string will be skipped according to the shift count stored 
in the shift SRAM. 

When the comparison of no-plane is missed or if the 
corresponding shift-count is zero, the filtering engine will enter 
the second step of virus detection. Then we further look up 
another signature table (called the yes-plane) to eliminate any 
false positives by ensuring that the prefix has the same 
signature. The yes-plane TCAM performs a modified bloom 
filter algorithm to reduce more exact comparisons. The filtering 
engine will skip the input datum if it is mismatched with the 
data of the yes-plane. 

VIII. NO-PLANE STRUCTURE 

The filtering engine screens impossible matches by 
consulting two TCAM lookup tables (named no-plane and yes- 
plane). Which are used to perform two steps of the on-chip 
data-scanning to obtain a fast shift table. This indicates the 
impossible matching patterns (so called no-plane). By 
comparing the input datum with the no-plane TCAM from the 
least significant bit (LSB), the engine first looks up the shift 
table to perform a quick shift of impossible bytes until locating 
a possible match. 

IX. YES-PLANE STRUCTURE 

When the comparison of no-plane is missed or if the 
corresponding shift-count is zero, the filtering engine will enter 
the second step of virus detection. Then we further look up 
another signature table (called the yes-plane) to eliminate any 
false positives by ensuring that the prefix has the same 
signature. The filtering engine will skip the input datum if it is 
mismatched with the data of the yes-plane. 
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X. EXACTLY MATCHING ENGINE 

If a possible match is still not ruled out, then the exactly- 
matching engine performs suffix matching by making 
comparisons with a suffix tree stored in off-chip memory, 
which can hold a large number of virus patterns. The off-chip 
memory needs roughly 8MB to store the entire 2MB virus 
patterns of the Clam AV. In the proposed process or the on- 
chip memory takes up over 75% of the overall power 
consumption and shares about 80% of the transistor count of 
the whole chip. Hence, compressing filtering data into the on- 
chip memory critically determines the performance and power 
efficiency for virus detection. In order to further reduce the 
power consumption and silicon cost of the on-chip memory. 

I. APPLICATIONS AND ADVANTAGES 

This pattern matching involves a vital role in this world. 
Almost in all applications, in day to day life, this pattern 
matching is involved. In parsers, spam filters, digital libraries, 
screen scrapers, word processors, web search engines, natural 
language processing, computational molecular biology, feature 
detection in digitized images. 

1. This project Achieve a high-throughput. 

2. Transistor count reduction is achieved in this project. 

3. Low-cost virus-detection. 

CONCLUSION 

This paper proposed an adaptive dividable dual-port Bit- 
CAM for a high-speed, low-power and low-cost pattern- 
detection processor in multiplication devices. The proposed 
dual-port match-line scheme reduces the transistor count and 
provides savings in power consumption compared to the 
single-port match-line scheme. The design of the adjustable 
division line provides high flexibility for updating virus 
databases. 
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